Fintech Android PCI Compliance and Screen Sanitization Checklist

Role: Lead Android Mobile Quality and Compliance Architect specializing in banking UI security and accessibility standards.

Context

• Financial Institution: {{institution_name}}
• PCI Scope Version: {{pci_dss_scope_version}}
• Accessibility Standard: {{target_accessibility_standard}}
• Integrated Third-Party SDKs: {{analytics_sdk_list}}
• Target Android Range: {{target_android_versions}}
• Data Classification Tier: {{data_classification_tier}}

Task

Generate a detailed compliance verification checklist ensuring all UI components, Jetpack Compose layouts, accessibility nodes, and system window buffers in {{institution_name}} prevent client-side financial data leakage.

Method

1. Inspect Activity and Window FLAG_SECURE implementations across all view transitions, backgrounding events, and recent app thumbnails.
2. Evaluate Jetpack Compose and View-based custom AccessibilityNodeInfo properties to ensure unmasked cardholder data is not leaked via TalkBack.
3. Audit primary clipboard operations, confirming auto-clear implementations and Android 13+ clipboard preview redactions.
4. Trace layout telemetry and crash recording behaviors across {{analytics_sdk_list}} to confirm automated masking of {{data_classification_tier}} fields.
5. Validate custom input fields (PIN entry, card inputs) against custom KeyboardView and third-party IME capture risks.
6. Verify memory hygiene of editable text fields, checking that CharSequence objects are cleared or avoided in favor of mutable char arrays.
7. Format findings into a multi-phase checklist indexed by regulatory control.

Constraints

• MUST evaluate both legacy Android Views and Jetpack Compose semantic nodes.
• MUST NOT compromise {{target_accessibility_standard}} compliance while enforcing data masking.
• Flag any third-party SDK in {{analytics_sdk_list}} that captures automated screen sessions.
• Enforce explicit verification steps for Android versions defined in {{target_android_versions}}.

Output format

• Section A: Window Security and Screen Capture Protections (4-5 items)
• Section B: Accessibility Semantics and TalkBack Data Privacy (4-5 items)
• Section C: Memory, Clipboard, and Third-Party SDK Sanitization (5-6 items)
• Item Format: [ ] Item Code | PCI-DSS Requirement | Test Procedure | Acceptance Threshold

Self-review

• Ensure no checklist item allows raw PAN or CVV retention in the view model.
• Verify TalkBack accessibility requirements remain usable for vision-impaired users.
• Confirm that FLAG_SECURE edge cases during app switching are fully addressed.